uniweb 0.62.0 → 0.63.1

package/src/commands/register.js

@@ -21,8 +21,13 @@
  *   uniweb register                      Build the .uwx, submit it, then deliver
  *                                        the foundation's dist/ code (plan +
  *                                        upload — see utils/code-upload.js)
- *   uniweb register --scope @org         Publish under @org (resolves @/x -> @org/x).
- *                                        Default: the package's package.json "uniweb.scope".
+ *   uniweb register --scope @org         A foundation whose name is bare: register it under
+ *                                        @org (resolves @/x -> @org/x) and write the scope
+ *                                        into its name in main.js. Refused when the name
+ *                                        already carries another scope — a foundation's
+ *                                        scope is the one in its name.
+ *                                        A schemas-only package: publish under @org.
+ *                                        Default: its package.json "uniweb.scope".
  *   uniweb register --schema-only        Skip the code delivery (schemas land, no dist upload)
  *   uniweb register --dry-run            Print the .uwx + the code file plan; submit nothing
  *   uniweb register -o foundation.uwx    Write the .uwx to a file; submit nothing
@@ -71,7 +76,8 @@ import {
   isSchemasPackage,
   collectStandaloneSchemas,
   readFoundationName,
-  checkFoundationName
+  checkFoundationName,
+  splitFoundationName
 } from '@uniweb/build'
 import {
   suggestFoundationName,
@@ -143,8 +149,10 @@ function cliVersion() {
   }
 }
 
-// The foundation's recorded publish org, from its package.json `uniweb.scope`
-// (`{ "uniweb": { "scope": "@acme" } }`) — the default when `--scope` is absent.
+// A SCHEMAS-ONLY package's recorded publish org, from its package.json `uniweb.scope`
+// (`{ "uniweb": { "scope": "@acme" } }`) — the default when `--scope` is absent. It
+// has no main.js whose name could carry it. ⛔ A foundation's scope is part of its name
+// (2026-09-22); its `uniweb.scope` is refused by `readFoundationName`.
 function readPkgScope(foundationDir) {
   try {
     const pkg = JSON.parse(
@@ -156,9 +164,10 @@ function readPkgScope(foundationDir) {
   }
 }
 
-// Record the chosen publish scope in the foundation's package.json so it travels
-// with the foundation (read back by readPkgScope on the next register). Preserves
-// the file's existing JSON style.
+// Record the chosen publish scope in a schemas-only package's package.json so it
+// travels with the package (read back by readPkgScope on the next register). Preserves
+// the file's existing JSON style. A foundation's goes into its name instead
+// (`settleFoundationScope`).
 async function writePkgScope(foundationDir, scope) {
   const path = join(foundationDir, 'package.json')
   const pkg = JSON.parse(readFileSync(path, 'utf8'))
@@ -293,6 +302,95 @@ export async function settleFoundationName(targetDir, { args, isPreview }) {
   return true
 }
 
+/**
+ * Settle the scope a foundation registers under — the one in its name.
+ *
+ * ⭐ THE SCOPE IS PART OF THE NAME (2026-09-22): `name: '@acme/marketing'` in main.js.
+ * A scoped name decides it, and a `--scope` naming another org is refused — which org
+ * was meant is not ours to guess, and today's alternative was a split identity (the
+ * foundation under one org, its data schemas under the other). A bare name has not
+ * registered yet: it takes `--scope`, else one derived from your orgs, and the chosen
+ * scope is WRITTEN INTO THE NAME, so it is chosen once and travels with the code.
+ * ⛔ Until then it was written to `package.json::uniweb.scope`, which is refused now
+ * (`readFoundationName`, naming the line to write).
+ *
+ * A preview (`--dry-run`, `-o`) writes nothing: a bare name previews under `--scope`,
+ * or unscoped.
+ *
+ * @returns {Promise<{ scope: string|null, source: string|null } | { cancelled: true } | null>}
+ *   null when refused (the reason is printed); `cancelled` when no org was chosen
+ */
+export async function settleFoundationScope(targetDir, { args, isPreview, flagScope, client }) {
+  let read
+  try {
+    read = await readFoundationName(targetDir)
+  } catch (err) {
+    error(err.message)
+    return null
+  }
+  const where = relative(process.cwd(), read.mainFile) || read.mainFile
+  const { scope: nameScope, bare } = splitFoundationName(read.name)
+
+  if (nameScope) {
+    if (flagScope && flagScope !== nameScope) {
+      error(
+        `${where} names this foundation ${read.name}, so it registers under ${nameScope} — ` +
+          `--scope ${flagScope} names another org.`
+      )
+      log(
+        `  ${colors.dim}To register it under ${flagScope}, change its name in ${where}: ` +
+          `name: '${flagScope}/${bare}'${colors.reset}`
+      )
+      return null
+    }
+    return { scope: nameScope, source: 'main.js' }
+  }
+
+  if (isPreview) return { scope: flagScope, source: flagScope ? '--scope' : null }
+
+  let scope = flagScope
+  let source = flagScope ? '--scope' : null
+  if (!scope) {
+    scope = await deriveScopeFromLogin(client, args)
+    if (!scope) return { cancelled: true }
+    source = 'login'
+  }
+
+  const scoped = `${scope}/${bare}`
+  const written = writeFoundationName(read.mainFile, scoped, {
+    replace: read.source === 'main.js' ? read.name : null
+  })
+  if (!written.ok) {
+    error(`Could not write the scope into the foundation's name: ${written.reason}.`)
+    log(`  Name it in the default export in ${colors.bright}${where}${colors.reset}:  name: '${scoped}',`)
+    return null
+  }
+  // Read it back through the build's own rule — the text edit is only a means.
+  const again = await readFoundationName(targetDir).catch(() => null)
+  if (again?.name !== scoped) {
+    error(`${where} now names the foundation '${scoped}', but it still reads as "${again?.name}".`)
+    return null
+  }
+  success(`This foundation registers as ${colors.bright}${scoped}${colors.reset} — kept in ${where}.`)
+  return { scope, source }
+}
+
+/**
+ * A publish scope derived from the login's org memberships (list → 1 use / 0 create /
+ * N pick), as `@handle` — or null when none was chosen.
+ */
+async function deriveScopeFromLogin(client, args) {
+  const token = await client.token()
+  const sess = await readRegistryAuth(client.origin)
+  const derived = await deriveScope({
+    apiBase: client.origin,
+    token,
+    accountHandle: sess?.handle || null,
+    args
+  })
+  return derived ? `@${derived}` : null
+}
+
 // Directories that are never foundation source. `dist` is the output we compare
 // against; the rest are tooling. Dotted entries are skipped wholesale.
 const NON_SOURCE_DIRS = new Set(['dist', 'node_modules'])
@@ -487,10 +585,13 @@ async function runRegister(args = []) {
     ? process.cwd()
     : await resolveFoundationDir(args)
 
-  // Scope: --scope flag, else package.json `uniweb.scope`, else (real submit
-  // only) derived from login membership in the bootstrap below. Either spelling,
-  // `@acme` or `acme`, and from here on the one form: `@acme` (publishScope).
-  const pkgScope = readPkgScope(targetDir)
+  // Scope. ⭐ A FOUNDATION's is the one in its name (`name: '@acme/marketing'` in
+  // main.js), settled below before the build; a bare name takes --scope, else one
+  // derived from your orgs, and register writes it into the name (2026-09-22).
+  // A SCHEMAS-ONLY package has no name to carry one: --scope, else package.json
+  // `uniweb.scope`, else (real submit only) derived from login membership. Either
+  // spelling, `@acme` or `acme`, and from here on the one form: `@acme` (publishScope).
+  const pkgScope = standalone ? readPkgScope(targetDir) : null
   const givenScope = scopeFlag || pkgScope
   let scope = publishScope(givenScope)
   let scopeSource = scopeFlag
@@ -530,6 +631,19 @@ async function runRegister(args = []) {
     if (!(await settleFoundationName(targetDir, { args, isPreview }))) {
       return { exitCode: 2 }
     }
+    // ⭐ BEFORE THE BUILD, so the build embeds the name the foundation registers as.
+    // Settled after it, a scope written into main.js would leave dist/ describing the
+    // bare name — stale the moment it was built.
+    const settled = await settleFoundationScope(targetDir, {
+      args,
+      isPreview,
+      flagScope: scope,
+      client
+    })
+    if (!settled) return { exitCode: 2 }
+    if (settled.cancelled) return { exitCode: 0 }
+    scope = settled.scope
+    scopeSource = settled.source
     // Build-if-stale (`foundationNeedsBuild`): a missing or stale dist/ gets
     // (re)built before we read its schema. Preview paths
     // (--dry-run / -o) must not write to dist/, so they require a pre-built
@@ -578,24 +692,18 @@ async function runRegister(args = []) {
     }
   }
 
-  // No scope for a real submit → derive it from login membership (list → 1 use /
-  // 0 create / N pick), persist to package.json, and reuse the session token.
-  if (!scope && !isPreview) {
-    const token = await client.token()
-    const sess = await readRegistryAuth(client.origin)
-    const derived = await deriveScope({
-      apiBase: client.origin,
-      token,
-      accountHandle: sess?.handle || null,
-      args
-    })
+  // A schemas-only package with no scope, on a real submit → derive it from login
+  // membership (list → 1 use / 0 create / N pick) and persist it to package.json.
+  // (A foundation's was settled before its build — `settleFoundationScope`.)
+  if (standalone && !scope && !isPreview) {
+    const derived = await deriveScopeFromLogin(client, args)
     if (!derived) return { exitCode: 0 }
-    scope = `@${derived}`
+    scope = derived
     scopeSource = 'login'
     try {
       await writePkgScope(targetDir, scope)
       info(
-        `Saved ${colors.bright}${scope}${colors.reset} as this ${standalone ? 'package' : 'foundation'}'s publish scope (package.json).`
+        `Saved ${colors.bright}${scope}${colors.reset} as this package's publish scope (package.json).`
       )
     } catch {
       log(
@@ -692,7 +800,9 @@ async function runRegister(args = []) {
   // Submit requires a concrete scope — the registry rejects @/… fail-closed.
   if (!scope) {
     error(
-      'No publish scope — set "uniweb.scope" in package.json, or pass --scope @org.'
+      standalone
+        ? 'No publish scope — set "uniweb.scope" in package.json, or pass --scope @org.'
+        : "No publish scope — name the foundation '@org/<name>' in main.js, or pass --scope @org."
     )
     log(
       `  ${colors.dim}Without a scope, names stay @/… and the registry rejects them.${colors.reset}`

package/src/commands/status.js

@@ -25,8 +25,14 @@ import { join } from 'node:path'
 import yaml from 'js-yaml'
 
 import { resolveSiteDir } from './deploy.js'
-import { probeUnpushed } from '../backend/site-sync.js'
-import { BackendClient, resolveBackendOrigin } from '../backend/client.js'
+import { probeUnpushed, nameSiteWorkspace, readSiteWorkspace } from '../backend/site-sync.js'
+import { readOrgFlag } from '../utils/args.js'
+import {
+  BackendClient,
+  resolveBackendOrigin,
+  workspaceHandle,
+  WorkspaceMismatchError
+} from '../backend/client.js'
 import { readBackendState } from '@uniweb/build/uwx'
 import {
   resolveLocalFoundation,
@@ -115,12 +121,22 @@ export async function status(args = []) {
   let site = null
   let fdnLatest = null
   let foundationFresh = null // true/false when both digests are known; else null
+  let remoteError = null // a refusal about the workspace — the one remote failure worth saying
   if (remote) {
     try {
       const client = new BackendClient({
         args,
         command: 'Status'
       })
+      // The workspace the site's requests name — as pull names it. A stale record is
+      // re-adopted from the backend's answer; `--json` keeps stdout to the document.
+      const orgFlag = readOrgFlag(args)
+      nameSiteWorkspace(client, {
+        siteDir,
+        workspace: orgFlag ? workspaceHandle(orgFlag) : readSiteWorkspace(siteDir, client.origin),
+        explicit: Boolean(orgFlag),
+        note: jsonMode ? undefined : say.dim
+      })
       if (uuid) site = await client.siteStatus(uuid)
       // Foundation freshness: prefer the LOCAL foundation's scoped name (so a
       // local-foundation site can be checked too); fall back to a scoped
@@ -134,8 +150,11 @@ export async function status(args = []) {
         const localDigest = computeFoundationDigest(join(local.dir, 'dist'))
         if (localDigest) foundationFresh = localDigest === fdnLatest.digest
       }
-    } catch {
-      // degrade silently
+    } catch (err) {
+      // Degrade silently — except a refusal about the workspace: `--org` named one the
+      // backend does not work on this site from, or the deployment has another. Saying
+      // nothing would read as "fine".
+      if (err instanceof WorkspaceMismatchError || err?.status === 409) remoteError = err.message
     }
   }
 
@@ -153,7 +172,8 @@ export async function status(args = []) {
               remote: {
                 site,
                 foundation_latest: fdnLatest?.latest_version ?? null,
-                foundation_fresh: foundationFresh
+                foundation_fresh: foundationFresh,
+                ...(remoteError ? { error: remoteError } : {})
               }
             }
           : {})
@@ -202,6 +222,7 @@ export async function status(args = []) {
 
   // Remote signals
   if (remote) {
+    if (remoteError) say.warn(remoteError)
     if (site) {
       if (site.draft_dirty) {
         say.info(

package/src/framework-index.json

@@ -1,16 +1,16 @@
 {
   "schemaVersion": 1,
-  "generatedAt": "2026-09-21T23:16:47.962Z",
+  "generatedAt": "2026-09-23T15:24:08.497Z",
   "packages": {
     "@uniweb/api": {
-      "version": "0.4.1",
+      "version": "0.5.0",
       "path": "framework/api",
       "deps": [
         "@uniweb/core"
       ]
     },
     "@uniweb/build": {
-      "version": "0.58.0",
+      "version": "0.59.0",
       "path": "framework/build",
       "deps": [
         "@uniweb/content-reader",
@@ -96,7 +96,7 @@
       "deps": []
     },
     "@uniweb/schemas": {
-      "version": "0.3.3",
+      "version": "0.3.4",
       "path": "framework/schemas",
       "deps": []
     },
@@ -116,7 +116,7 @@
       "deps": []
     },
     "@uniweb/templates": {
-      "version": "0.16.0",
+      "version": "0.16.1",
       "path": "framework/templates",
       "deps": []
     },
@@ -126,7 +126,7 @@
       "deps": []
     },
     "@uniweb/unipress": {
-      "version": "0.10.1",
+      "version": "0.10.2",
       "path": "framework/unipress",
       "deps": [
         "@uniweb/build",

package/src/index.js

@@ -1456,11 +1456,12 @@ ${colors.bright}Options:${colors.reset}
                      bind to, and the app cannot open such a site.
   --no-save          Do not record this deploy in deploy.yml
   --no-validate      Skip the content-conformance check (it only warns)
-  --org @org         Publish under @org (membership-gated; alias: --as-org). Read
-                     only on a site's FIRST publish — that create decides which org
-                     owns the site, and whose storage its assets are charged to.
-                     Recorded in sync.json and replayed, so it is never
-                     re-typed. Without it, you are asked once.
+  --org @org         Publish under @org (membership-gated). On a site's FIRST
+                     publish it decides which org owns the site, and whose storage
+                     its assets are charged to. Recorded in sync.json and named on
+                     every request after, so it is never re-typed. Without it, you
+                     are asked once. Later, it must match the workspace the backend
+                     works on the site from, or publish stops.
   --personal         Create the site under your personal account, deliberately.
                      Only needed on a first publish, and only to answer the owner
                      question without a prompt (CI, agents, scripts).
@@ -1725,13 +1726,18 @@ Auto-detects what you run it in:
   • a schemas-only pkg   just its data schemas, no foundation — e.g. @uniweb/schemas,
                          any @org/schemas package, or a bare schemas/*.yml folder
 
-Schema scopes (set the org with --scope, or package.json uniweb.scope):
-  @/name     your own schema, scoped to the publish org   (@/x -> @org/x)
+A foundation's scope is part of its name — name: '@org/<name>' in main.js. A bare
+name takes --scope (or one of your orgs), and register writes it into the name.
+
+Schema scopes:
+  @/name     your own schema, in the foundation's scope   (@/x -> @org/x)
   @std/name  a shared standard schema (from @uniweb/schemas)
   @org/name  another org's published schema, referenced by name
 
 ${colors.bright}Options:${colors.reset}
-  --scope @org       Publish under @org (resolves @/x -> @org/x); default: package.json uniweb.scope
+  --scope @org       A foundation with a bare name: register under @org, and write it into
+                     the name (refused when the name has another scope). A schemas-only
+                     package: publish under @org; default: package.json uniweb.scope
   --dry-run          Print the .uwx; submit nothing
   -o, --output <f>   Write the .uwx to a file; submit nothing
   --non-interactive  Fail with usage info instead of prompting

package/src/utils/args.js

@@ -21,25 +21,17 @@
  * @returns {string | null | undefined}
  */
 /**
- * The org a site is created under. `--org` is the documented spelling; `--as-org`
- * is a working alias.
+ * The workspace a site command names — `--org @acme` — and, on a site's first push or
+ * publish, the org it is created under.
  *
- * `--as-org` mirrors the wire (`?as_org=`) and names an *acting capacity* — the
- * request is made as a member of that org, membership-gated. That is accurate, and
- * it is also not the name anyone reaches for: asked in one day, the backend's docs
- * said `--as-unit` and a second reader said `--org`; nobody produced `--as-org`.
- * Since the flag's main job is answering *who owns this site*, `--org` is the name
- * that matches the question, and the alias costs one `||` (the same shape
- * `--backend` already uses).
- *
- * `||`, not `??`, on purpose: a valueless `--org` falls through to `--as-org`
- * rather than shadowing it.
+ * ⛔ `--as-org` is RETIRED (2026-09-23). It mirrored the wire's `?as_org=`, which the
+ * `x-uniweb-workspace` header replaced; `flag-guard.js` refuses it and names `--org`.
  *
  * @param {string[]} args
  * @returns {string|null|undefined}
  */
 export function readOrgFlag(args) {
-  return readFlagValue(args, '--org') || readFlagValue(args, '--as-org')
+  return readFlagValue(args, '--org')
 }
 
 /**
@@ -97,7 +89,7 @@ function editDistance(a, b) {
 
 /**
  * The closest known flag to `flag`, or null when nothing is close enough.
- * The threshold scales with length so `--org` → `--as-org` is offered while two
+ * The threshold scales with length so `--forcee` → `--force` is offered while two
  * unrelated short flags are not.
  * @param {string} flag
  * @param {string[]} known

package/src/utils/flag-guard.js

@@ -50,12 +50,11 @@ const VIA_DEPLOY = ['--target', '--host', '--no-save']
 /**
  * Per-verb flag sets. Derived by scanning each command for dash-literals AND the
  * helpers it calls — not from the help text, which has drifted from the parser in
- * both directions (`--as-org` was implemented and undocumented; `--yes` is
- * documented on `publish` and consumed two files away).
+ * both directions (`--yes` is documented on `publish` and consumed two files away).
  */
 const VERBS = {
   push: [
-    '--all', '--as-org', '--org', '--dry-run', '--force',
+    '--all', '--org', '--dry-run', '--force',
     '--foundation', '--output', '-o', '--personal',
     // read in utils/conformance.js and backend/site-sync.js respectively —
     // neither appears in push.js
@@ -69,7 +68,7 @@ const VERBS = {
     '--no-release', ...VIA_DEPLOY
   ],
   publish: [
-    '--as-org', '--org', '--dry-run', '--force', '--foundation',
+    '--org', '--dry-run', '--force', '--foundation',
     '--personal',
     // read in utils/conformance.js, backend/site-sync.js, and
     // backend/foundation-bring-along.js — none appear in publish.js
@@ -80,15 +79,15 @@ const VERBS = {
     '--no-assets',
     '--no-records', '--no-delete', '--no-prune',
     // via backend/site-sync.js (the owner resolver) and utils/conformance.js
-    '--yes', '--org', '--as-org', '--no-validate', ...VIA_DEPLOY
+    '--yes', '--org', '--no-validate', ...VIA_DEPLOY
   ],
   clone: [
     '--content-only', '--no-assets', '--no-records', '--path',
-    '--project', '--org', '--as-org'
+    '--project', '--org'
   ],
   register: [
     '--dry-run', '--json', '--output', '-o',
-    '--schema-only', '--scope', '--org', '--as-org'
+    '--schema-only', '--scope', '--org'
   ],
   /**
    * `forget` = remove one backend's records (`--backend <url>`), or everything a
@@ -99,7 +98,7 @@ const VERBS = {
   forget: ['--backend', '--all'],
   status: [
     '--json', '--remote', '--dry-run',
-    '--force', '--no-verify', '--no-validate', '--yes', '--org', '--as-org',
+    '--force', '--no-verify', '--no-validate', '--yes', '--org',
     // inert here, reachable through the bring-along module status imports for
     // `resolveLocalFoundation` — listed per the over-approximation note above
     '--no-release', ...VIA_DEPLOY
@@ -119,7 +118,7 @@ const VERBS = {
    */
   refresh: [
     '--no-backend', '--no-git',
-    '--as-org', '--org', '--dry-run', '--no-validate', '--yes', ...VIA_DEPLOY
+    '--org', '--dry-run', '--no-validate', '--yes', ...VIA_DEPLOY
   ]
 }
 
@@ -213,6 +212,15 @@ export function checkFlags(verb, args = []) {
       ].join('\n')
     }
   }
+  // ⭐ `--as-org` is RETIRED (2026-09-23) with the `?as_org=` it mirrored — the request
+  // names its workspace in a header now, and `--org` is the one spelling.
+  if (flag === '--as-org' && all.includes('--org')) {
+    return {
+      flag,
+      suggestion: '--org',
+      message: `\`--as-org\` is retired — use \`--org @org\` (e.g. \`uniweb ${verb} --org @acme\`).`
+    }
+  }
   const suggestion = didYouMean(flag, all)
   const lines = [`Unknown flag \`${flag}\` for \`uniweb ${verb}\`.`]
   if (suggestion) lines.push(`  Did you mean \`${suggestion}\`?`)

package/src/utils/registry-orgs.js

@@ -61,8 +61,9 @@ export function bareHandle(scope) {
 
 /**
  * A publish scope in the one form the registry names things by — `@acme` — from any
- * spelling `--scope` or `package.json::uniweb.scope` may carry it in (`@acme`, `acme`,
- * `@acme/…`). Null when there is no handle in it.
+ * spelling `--scope` or a schemas-only package's `package.json::uniweb.scope` may carry
+ * it in (`@acme`, `acme`, `@acme/…`). Null when there is no handle in it. (A
+ * foundation's scope is part of its name, `@acme/marketing`, and needs no reading.)
  *
  * ⛔ Every name built from a scope goes through this. The `.uwx` assembly
  * (`@uniweb/build`'s `buildRegistryPackage`) has always accepted `acme` as well as

package/src/utils/site-data-upload.js

@@ -51,6 +51,7 @@
  * demonstrated.**
  */
 
+import { WORKSPACE_HEADER } from '../backend/client.js'
 import { createHash } from 'node:crypto'
 import { humanBytes } from './bytes.js'
 import { fetchWithRetry, isTransientStatus } from './fetch-retry.js'
@@ -62,6 +63,9 @@ import { fetchWithRetry, isTransientStatus } from './fetch-retry.js'
  * @param {string} opts.apiBase - backend origin
  * @param {string} opts.token - bearer, used on the direct arm only
  * @param {string} opts.siteUuid - the site these files belong to (path segment)
+ * @param {string|null} [opts.workspace] - the workspace the requests name, `@handle`
+ *   (`x-uniweb-workspace`) — on the plan and on every DIRECT PUT, never on a presigned
+ *   one, which is self-authorizing and must carry nothing it was not signed with
  * @param {{ data: Record<string, unknown> }|null} opts.ball - source of the set:
  *   `{ "<relpath under dist/data>": <json> }`, media refs already rewritten
  * @param {(m: string) => void} [opts.onProgress]
@@ -72,9 +76,13 @@ export async function uploadSiteData({
   apiBase,
   token,
   siteUuid,
+  workspace = null,
   ball,
   onProgress = () => {}
 }) {
+  // A plan made with the header mints BARE PUT urls: the PUT names its workspace with
+  // the header like every other request (backend, 2026-09-23).
+  const workspaceHeader = workspace ? { [WORKSPACE_HEADER]: workspace } : {}
   // ⛔ An EMPTY set still posts a plan, and that is the whole point of this lane
   // being a manifest rather than a stream of files.
   //
@@ -131,7 +139,8 @@ export async function uploadSiteData({
       method: 'POST',
       headers: {
         'Content-Type': 'application/json',
-        Authorization: `Bearer ${token}`
+        Authorization: `Bearer ${token}`,
+        ...workspaceHeader
       },
       body: JSON.stringify({
         files: files.map(({ path, content_type, size, sha256 }) => ({
@@ -172,7 +181,9 @@ export async function uploadSiteData({
   // PUT is a bearer-authed backend route; a presigned URL is self-authorizing
   // and must NOT carry a foreign bearer, which can break signature validation.
   const authHeaders =
-    plan.mode === 'presigned' ? {} : { Authorization: `Bearer ${token}` }
+    plan.mode === 'presigned'
+      ? {}
+      : { Authorization: `Bearer ${token}`, ...workspaceHeader }
 
   const uploaded = []
   const failed = []